by Kastro
Paper/Archive/CVE-2026-2446

CVE-2026-2446

Unknown PowerPack for LearnDash — Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.6.366 × 207.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

Affected

ProductAffectedFixed inSource
PowerPack for LearnDash< 1.3.01.3.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7